One objective in the field of computer security is to prevent tampering with a program while it executes. One way to tamper with a program is to load, into the program's address space, code or data that causes the program to behave in an unexpected way. Thus, certain types of tampering can be prevented by controlling what can be loaded into a program's address space, and requiring the program to run in an environment that has certain security features. One way to exert such control over the execution of a program is to associate the program with a “manifest,” which is a document or other data structure that describes the restrictions and security features of an environment in which a software object is permitted to execute. The execution environment can then enforce the manifest as the program executes.
One example situation in which a manifest is useful is in the case of Digital Rights Management (DRM) applications, which control access to valuable information (e.g., copyrighted audio, video, text, etc.). A DRM system generally uses cryptography to protect content, and is able to decrypt the content for approved uses. Allowing rogue code modules into the address space of the DRM system software would allow those rogue modules to access decrypted content in that address space, and to make unauthorized distribution or use of the content. Thus, a software vendor whose software needs to work with a DRM system provides a manifest with the software that describes the rules governing what may or may not be loaded into the software's address space, which provides some assurance that the vendor's software will behave as expected and can safely be given access to the information that the DRM system protects. (DRM is one example of a situation where computer security is important, although there are numerous other examples as well.)
It is theoretically possible to create a manifest by hand, although it is impractical to do so. The manifest creation process may include various cryptographic operations, such as digital signing, certificate chaining, computation of hashes, etc. Moreover, the manifest that is ultimately produced is an (often lengthy) XRML (eXtensible Rights Markup Language) file, which is an unwieldy format for a programmer to work with by hand. Thus, it is desirable to have a mechanism that automate portions of the manifest generation process, without involving a programmer in the details of performing cryptographic operations, or requiring the programmer to create an XRML file by hand.
In view of the foregoing, there is a need for a mechanism that overcomes the drawbacks of the prior art.